A Time‑of‑Check to Time‑of‑Use flaw in the cp command of uutils coreutils allows an attacker to bypass the no‑dereference intent by replacing a regular file with a symbolic link between the verification step and the open operation. The utility checks for a symlink using path‑based metadata, then opens the target without the O_NOFOLLOW flag. An attacker who can write to the same location during the window can swap the file, causing a privileged copy process to read and write the contents of arbitrary sensitive files into an attacker‑controlled destination, exposing confidential data.

The vulnerability affects the Uutils coreutils product, specifically the cp utility. No specific version numbers are provided in the advisory, so all releases that include cp may be vulnerable until a patch is released.

The CVSS score is 4.7, indicating a moderate severity. No EPSS score is available, so the exploit probability is unknown; the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector requires the attacker to have concurrent write access to the file or directory being copied and the ability to run the cp command with elevated privileges. Marked as a potential information‑disclosure risk, it is best to patch or mitigate promptly.